How to Reverse Engineering NosTale?

[Pumba98]

Originally Posted by Koffy1

SOLVED, TY PUMBA

And now using the cryptography of Cryless~, what I am suposed to introduce as a parameter to this method? I want to put my username and password but it takes a string.

std::vector<unsigned char> encryptLoginPacket(const std::string& buf) const;

This is my code

Crypto client;
std::string username = "test";
std::string password = "1234";

client.randomNumber(0, 1000);
client.createLoginVersion();
client.createLoginHash(username);
client.encryptPasswordString(password);
client.encryptLoginPacket("I don't know what to put here") // It takes a string as parameter

int ret = send(ConnectSocket, "const char buf* of login packet?", "int len", "int flags");

Look at the project or read in other threads how the login packet etc need to be build etc. You don't need the PW encrypt function

[Koffy1]

Originally Posted by Pumba98

Look at the project or read in other threads how the login packet etc need to be build etc. You don't need the PW encrypt function

Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash

[MarsBounty]

Originally Posted by Koffy1

Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash

i just tried the source and it does still work if you change the hashs and version variables

But it uses the old login packet not the new gf packet which you probably compared it to.

[Pumba98]

Originally Posted by Koffy1

Is this createloginpacket outdated? When I checked the actual login packet it was a little different in terms of creating the complete string packet. I mean this code
(QString complete = beginn + " " + username + " " + passwordhash + diff + version+ " 0" + " " +loginhash

"NoS0575 " +randomNumber + " " + id + " " + sha512(pw) + " " + uuid + " " + loginVersion + nosVersion + " 0 " + md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id);

[Koffy1]

How do I do this part? (ID = robert)
"md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id"

The MD5 of NostaleClientX.exe is = 795522c0be350c1152727163d3a8e589
And MD5 of NostaleClient.exe is = a0de15dda5134ccff9b5cd87f3249de8

It should be now md5 of (nostaleclientx.exe + nostaleclient.exe + id)
795522c0be350c1152727163d3a8e589a0de15dda5134ccff9 b5cd87f3249de8robert
and the md5 is = 13bddfcb6a8de597dcb483d87df1a694

but in my actual code there is another md5, what did I do wrong?

1018DC77     4E 6F 53 30 35 37 35 20 38 31 34 32 38 32 35   NoS0575 8142825
1018DC87  20 72 6F 62 65 72 74 20 33 36 32 37 39 30 39 41   robert 3627909A
1018DC97  32 39 43 33 31 33 38 31 41 30 37 31 45 43 32 37  29C31381A071EC27
1018DCA7  46 37 43 39 43 41 39 37 37 32 36 31 38 32 41 45  F7C9CA97726182AE
1018DCB7  44 32 39 41 37 44 44 44 32 45 35 34 33 35 33 33  D29A7DDD2E543533
1018DCC7  32 32 43 46 42 33 30 41 42 42 39 45 33 41 36 44  22CFB30ABB9E3A6D
1018DCD7  46 32 41 43 32 43 32 30 46 45 32 33 34 33 36 33  F2AC2C20FE234363
1018DCE7  31 31 44 36 37 38 35 36 34 44 30 43 38 44 33 30  11D678564D0C8D30
1018DCF7  35 39 33 30 35 37 35 46 36 30 45 32 44 33 44 30  5930575F60E2D3D0
1018DD07  34 38 31 38 34 44 37 39 20 63 35 39 34 39 34 37  48184D79 c594947
1018DD17  66 2D 64 34 61 39 2D 34 34 36 32 2D 62 35 34 35  f-d4a9-4462-b545
1018DD27  2D 61 64 37 64 64 62 66 64 37 31 61 32 20 30 30  -ad7ddbfd71a2 00
1018DD37  32 46 37 43 35 37 0B 30 2E 39 2E 33 2E 33 31 30  2F7C570.9.3.310
1018DD47  31 20 30 20 43 43 36 35 34 36 44 38 43 38 30 44  1 0 CC6546D8C80D
1018DD57  34 33 43 34 39 45 46 37 35 34 38 46 31 33 39 34  43C49EF7548F1394
1018DD67  44 32 37 46                                      D27F

[Pumba98]

Originally Posted by Koffy1

How do I do this part? (ID = robert)
"md5(md5(NostaleClientX.exe) + md5(NostaleClient.exe) + id"

The MD5 of NostaleClientX.exe is = 795522c0be350c1152727163d3a8e589
And MD5 of NostaleClient.exe is = a0de15dda5134ccff9b5cd87f3249de8

It should be now md5 of (nostaleclientx.exe + nostaleclient.exe + id)
795522c0be350c1152727163d3a8e589a0de15dda5134ccff9 b5cd87f3249de8robert
and the md5 is = 13bddfcb6a8de597dcb483d87df1a694

but in my actual code there is another md5, what did I do wrong?

1018DC77     4E 6F 53 30 35 37 35 20 38 31 34 32 38 32 35   NoS0575 8142825
1018DC87  20 72 6F 62 65 72 74 20 33 36 32 37 39 30 39 41   robert 3627909A
1018DC97  32 39 43 33 31 33 38 31 41 30 37 31 45 43 32 37  29C31381A071EC27
1018DCA7  46 37 43 39 43 41 39 37 37 32 36 31 38 32 41 45  F7C9CA97726182AE
1018DCB7  44 32 39 41 37 44 44 44 32 45 35 34 33 35 33 33  D29A7DDD2E543533
1018DCC7  32 32 43 46 42 33 30 41 42 42 39 45 33 41 36 44  22CFB30ABB9E3A6D
1018DCD7  46 32 41 43 32 43 32 30 46 45 32 33 34 33 36 33  F2AC2C20FE234363
1018DCE7  31 31 44 36 37 38 35 36 34 44 30 43 38 44 33 30  11D678564D0C8D30
1018DCF7  35 39 33 30 35 37 35 46 36 30 45 32 44 33 44 30  5930575F60E2D3D0
1018DD07  34 38 31 38 34 44 37 39 20 63 35 39 34 39 34 37  48184D79 c594947
1018DD17  66 2D 64 34 61 39 2D 34 34 36 32 2D 62 35 34 35  f-d4a9-4462-b545
1018DD27  2D 61 64 37 64 64 62 66 64 37 31 61 32 20 30 30  -ad7ddbfd71a2 00
1018DD37  32 46 37 43 35 37 0B 30 2E 39 2E 33 2E 33 31 30  2F7C570.9.3.310
1018DD47  31 20 30 20 43 43 36 35 34 36 44 38 43 38 30 44  1 0 CC6546D8C80D
1018DD57  34 33 43 34 39 45 46 37 35 34 38 46 31 33 39 34  43C49EF7548F1394
1018DD67  44 32 37 46                                      D27F

All partial hashes should be uppercase

[Koffy1]

Once I created the login packet succesfully and connected to the server via socket, how do I login sending my login packet? (at least in the login screen, I don't want to be in the game) I tried this but didn't work. I checked if the account was on in the login screen with a multiclient, but it wasn't.

send(ConnectSocket, sendPacket.c_str(), packetLength, 0);

[Pumba98]

Originally Posted by Koffy1

Once I created the login packet succesfully and connected to the server via socket, how do I login sending my login packet? (at least in the login screen, I don't want to be in the game) I tried this but didn't work. I checked if the account was on in the login screen with a multiclient, but it wasn't.

send(ConnectSocket, sendPacket.c_str(), packetLength, 0);

Encrypt the packet and send it to the loginserver.
Then check what the server responds

[Koffy1]

Originally Posted by Pumba98

Encrypt the packet and send it to the loginserver.
Then check what the server responds

I've already encrypted the packet, but loginserver? Do you mean the ip of nostale and the port? I'm already connected to the loginserver, how do I send the send function?

[IceTrailer]

Originally Posted by Koffy1

I've already encrypted the packet, but loginserver? Do you mean the ip of nostale and the port? I'm already connected to the loginserver, how do I send the send function?

Are you sure that you are connected with the login server?

[Koffy1]

Originally Posted by IceTrailer

Are you sure that you are connected with the login server?

Mmm... I mean I succesfully connected with sockets to the game server using the ip and the port. If that's not the login server, I don't know what is it. Could you explain me?

[szymek111]

Login server and game server are two different separate connections. Login server is before selecting the server and channel and game server connection is after selecting the right server.

[Nortank]

you have to check the NsTest packet after the login connection, it contains the game ip and the game port which are needed to connect to the game server.

take a look at

[Koffy1]

Is it possible to open NosTale.exe ( The Launcher ) in OllyDbg and start the game without any crash in ollydbg? I tried to do it but it replaces the NosTale.exe into NosTale.exe.DELETE and it terminate the process.
Is the same thing running NostaleClientX.exe and the Nostale.exe launcher?

[WalrossGreat]

It is, check the parameters when you run the program in normal way, when you are launching it directly from the debugger you are lacking arguments